Bug 1196648: IonMonkey - Don't run the lazy link stub for asmjs to jit fastpath, r=nbp

js/src/asmjs/AsmJSModule.cpp

@@ -539,6 +539,12 @@ TryEnablingJit(JSContext* cx, AsmJSModule& module, HandleFunction fun, uint32_t
         return true;
     }
 
+    // Don't enable jit entry when we have a pending ion builder.
+    // Take the interpreter path which will link it and enable
+    // the fast path on the next call.
+    if (script->baselineScript()->hasPendingIonBuilder())
+        return true;
+
     // Currently we can't rectify arguments. Therefore disabling if argc is too low.
     if (fun->nargs() > size_t(argc))
         return true;

js/src/jit-test/tests/ion/bug1196648.js

@@ -0,0 +1,18 @@
+h = function(m, foreign, n) {
+    "use asm";
+    var ff = foreign.ff;
+    function f(x) {
+        x = +x;
+        ff();
+    }
+    return f;
+}(0, {
+    ff: function() {
+        return {
+            e: String.prototype.substring
+        };
+    }
+}, 0);
+for (var k = 0; k < 999; k++) {
+    h();
+}

js/src/jit/BaselineJIT.cpp

@@ -478,6 +478,21 @@ BaselineScript::Destroy(FreeOp* fop, BaselineScript* script)
     fop->delete_(script);
 }
 
+void
+BaselineScript::clearDependentAsmJSModules()
+{
+    // Remove any links from AsmJSModules that contain optimized FFI calls into
+    // this BaselineScript.
+    if (dependentAsmJSModules_) {
+        for (size_t i = 0; i < dependentAsmJSModules_->length(); i++) {
+            DependentAsmJSModuleExit exit = (*dependentAsmJSModules_)[i];
+            exit.module->detachJitCompilation(exit.exitIndex);
+        }
+
+        dependentAsmJSModules_->clear();
+    }
+}
+
 void
 BaselineScript::unlinkDependentAsmJSModules(FreeOp* fop)
 {

js/src/jit/BaselineJIT.h

@@ -401,6 +401,7 @@ struct BaselineScript
 
     bool addDependentAsmJSModule(JSContext* cx, DependentAsmJSModuleExit exit);
     void unlinkDependentAsmJSModules(FreeOp* fop);
+    void clearDependentAsmJSModules();
     void removeDependentAsmJSModule(DependentAsmJSModuleExit exit);
 
     // Toggle debug traps (used for breakpoints and step mode) in the script.
@@ -477,6 +478,9 @@ struct BaselineScript
 
         pendingBuilder_ = builder;
 
+        // lazy linking cannot happen during asmjs to ion.
+        clearDependentAsmJSModules();
+
         script->updateBaselineOrIonRaw(maybecx);
     }
     void removePendingIonBuilder(JSScript* script) {